HGABAC: Towards a Formal Model of Hierarchical Attribute-Based - PowerPoint PPT Presentation

HGABAC: Towards a Formal Model of Hierarchical Attribute-Based Access Control Sylvia L. Osborn Daniel Servos sylvia@csd.uwo.ca dservos5@uwo.ca Department of Computer Science The 7th International Symposium on Foundations & Practice of Security, November 2014 Daniel Servos & Sylvia L. Osborn HGABAC FPS’2014 1 / 31

Background Role-Based Access Control (RBAC) Daniel Servos & Sylvia L. Osborn HGABAC FPS’2014 2 / 31

Background Role-Based Access Control (RBAC) Daniel Servos & Sylvia L. Osborn HGABAC FPS’2014 2 / 31

Background Role-Based Access Control (RBAC) Daniel Servos & Sylvia L. Osborn HGABAC FPS’2014 2 / 31

Background Attribute-Based Access Control (ABAC) Daniel Servos & Sylvia L. Osborn HGABAC FPS’2014 2 / 31

Background Attribute-Based Access Control (ABAC) Daniel Servos & Sylvia L. Osborn HGABAC FPS’2014 2 / 31

Background Attribute-Based Access Control (ABAC) Daniel Servos & Sylvia L. Osborn HGABAC FPS’2014 2 / 31

Background Attribute-Based Access Control (ABAC) Daniel Servos & Sylvia L. Osborn HGABAC FPS’2014 2 / 31

Related Work & Current Models Comparison of Notable Models of Attribute-Based Access Control Logic-based ABAC for Framework ABAC α Web WS-ABAC ABMAC for ABAC Services Hierarchical ✗ ✗ ✗ ✗ Hierarchical attributes Object ✗ ✓ ✓ ✓ ✓ Attributes ✓ ✓ ✓ ✓ ✓ User Attributes Environment ✗ ✗ ✓ ✓ ✓ Attributes Shown in Connection ✗ ✗ ✗ ✗ example but Attributes not model Administrative ✗ ✗ ✗ ✗ ✗ Attributes Separation of ✗ ✗ ✗ ✗ ✗ Duties For web For web For grid ✓ ✓ General Model services services computing Only models ✓ ✓ Formal Model policies and Simplistic Simplistic evaluation Administrative ✗ ✗ ✗ ✗ Limited Model Can Model Not demon- Not demon- Not demon- Not demon- ✓ DAC, MAC, strated strated strated strated and RBAC Daniel Servos & Sylvia L. Osborn HGABAC FPS’2014 5 / 31

Related Work & Current Models Comparison of Notable Models of Attribute-Based Access Control Logic-based ABAC for Framework ABAC α Web WS-ABAC ABMAC for ABAC Services Hierarchical ✗ ✗ ✗ ✗ Hierarchical Open Problems attributes Object ✗ ✓ ✓ ✓ ✓ Attributes Lack of hierarchical structures comparable to RBAC. ✓ ✓ ✓ ✓ ✓ User Attributes Environment Lack of group based administration of multiple users. ✗ ✗ ✓ ✓ ✓ Attributes Shown in Connection Limited work towards a separation of duties model for ABAC. ✗ ✗ ✗ ✗ example but Attributes not model Administrative Limited work towards a administrative model of ABAC. ✗ ✗ ✗ ✗ ✗ Attributes Separation of ✗ ✗ ✗ ✗ ✗ Auditability of ABAC systems. Duties For web For web For grid ✓ ✓ General Model Need for formal foundational models of ABAC. services services computing Only models ✓ ✓ Formal Model policies and Simplistic Simplistic evaluation Administrative ✗ ✗ ✗ ✗ Limited Model Can Model Not demon- Not demon- Not demon- Not demon- ✓ DAC, MAC, strated strated strated strated and RBAC Daniel Servos & Sylvia L. Osborn HGABAC FPS’2014 5 / 31

Related Work & Current Models Comparison of Notable Models of Attribute-Based Access Control Logic-based ABAC for Framework ABAC α Web WS-ABAC ABMAC for ABAC Services Hierarchical ✗ ✗ ✗ ✗ Hierarchical Open Problems attributes Object ✗ ✓ ✓ ✓ ✓ Attributes Lack of hierarchical structures comparable to RBAC. ✓ ✓ ✓ ✓ ✓ User Attributes Environment Lack of group based administration of multiple users. ✗ ✗ ✓ ✓ ✓ Attributes Shown in Connection Limited work towards a separation of duties model for ABAC. ✗ ✗ ✗ ✗ example but Attributes not model Administrative Limited work towards a administrative model of ABAC. ✗ ✗ ✗ ✗ ✗ Attributes Separation of ✗ ✗ ✗ ✗ ✗ Auditability of ABAC systems. Duties For web For web For grid ✓ ✓ General Model Need for formal foundational models of ABAC. services services computing Only models ✓ ✓ Formal Model policies and Simplistic Simplistic evaluation Administrative ✗ ✗ ✗ ✗ Limited Model Can Model Not demon- Not demon- Not demon- Not demon- ✓ DAC, MAC, strated strated strated strated and RBAC Daniel Servos & Sylvia L. Osborn HGABAC FPS’2014 5 / 31

Related Work & Current Models Comparison of Notable Models of Attribute-Based Access Control Logic-based ABAC for Framework ABAC α Web WS-ABAC ABMAC HGABAC for ABAC Services Hierarchical ✗ ✗ ✗ ✗ ✓ Hierarchical attributes Object ✗ ✓ ✓ ✓ ✓ ✓ Attributes ✓ ✓ ✓ ✓ ✓ ✓ User Attributes Environment ✗ ✗ ✓ ✓ ✓ ✓ Attributes Shown in Connection ✗ ✗ ✗ ✗ ✓ example but Attributes not model Administrative ✗ ✗ ✗ ✗ ✗ ✓ Attributes Separation of ✗ ✗ ✗ ✗ ✗ ✗ Duties For web For web For grid ✓ ✓ ✓ General Model services services computing Only models ✓ ✓ ✓ Formal Model policies and Simplistic Simplistic evaluation Administrative ✗ ✗ ✗ ✗ ✗ Limited Model Can Model Not demon- Not demon- Not demon- Not demon- ✓ ✓ DAC, MAC, strated strated strated strated and RBAC Daniel Servos & Sylvia L. Osborn HGABAC FPS’2014 5 / 31

HGABAC Model User Object User Attribute Users Assignment Attributes Attributes Object Attribute Assignment Objects Daniel Servos & Sylvia L. Osborn HGABAC FPS’2014 6 / 31

HGABAC Model Attributes attr = (name, type, value) User Object User Attribute Users Assignment Attributes Attributes Object Attribute Assignment Objects Daniel Servos & Sylvia L. Osborn HGABAC FPS’2014 6 / 31

HGABAC Model Policies User Object User Attribute Users Assignment Attributes Attributes Object Attribute Assignment Objects Daniel Servos & Sylvia L. Osborn HGABAC FPS’2014 6 / 31

Policy Language Three-valued logic (True, False and Undefined). Boolean statements using AND, OR, and NOT logical operations. AND, OR and NOT truth tables from Kleene K3 logic. Support for value and set comparison operations < , > , ≤ , ≥ , =, � =, ∈ , ⊂ , etc. Daniel Servos & Sylvia L. Osborn HGABAC FPS’2014 7 / 31

Policy Language Three-valued logic (True, False and Undefined). Boolean statements using AND, OR, and NOT logical operations. AND, OR and NOT truth tables from Kleene K3 logic. Support for value and set comparison operations < , > , ≤ , ≥ , =, � =, ∈ , ⊂ , etc. Examples (a) user.id IN { 5, 72, 4, 6, 4 } OR user.id = object.owner (b) object.required perms SUBSET user.perms AND user.age > = 18 (c) user.admin OR (user.role = “doctor” AND user.id != object.patient) Daniel Servos & Sylvia L. Osborn HGABAC FPS’2014 7 / 31

HGABAC Model Policies User Object User Attribute Users Assignment Attributes Attributes Object Attribute Assignment Objects Daniel Servos & Sylvia L. Osborn HGABAC FPS’2014 8 / 31

HGABAC Model Permissions Policies Operations User Object User Attribute Users Assignment Attributes Attributes Object Attribute Assignment Objects Daniel Servos & Sylvia L. Osborn HGABAC FPS’2014 8 / 31

HGABAC Model Permissions Policies Operations User Object User Attribute Users Assignment Attributes Attributes Object Attribute Assignment Objects Permissions user.id = object.patient OR user.role = “doctor” → read user.role = “doctor” → write Daniel Servos & Sylvia L. Osborn HGABAC FPS’2014 8 / 31

HGABAC Model Permissions Policies Operations User Object User Attribute Users Assignment Attributes Attributes Object Attribute Assignment User Session Objects Attribute Sessions Activation Daniel Servos & Sylvia L. Osborn HGABAC FPS’2014 8 / 31

HGABAC Model Permissions User Group User User Group Attribute Hierarchy Groups Assignment Policies Operations User Group Assignment User Object User Attribute Users Assignment Attributes Attributes Object Attribute Assignment User Session Objects Attribute Sessions Activation Daniel Servos & Sylvia L. Osborn HGABAC FPS’2014 8 / 31

Group Graph Min Group {} Undergrads Staff {(studet_level, 1), {(employe_level, 1), (room_access, {MC8, (room_access, MC10})} {MC355})} Faculty Gradstudents {(studet_level, 2), {(employe_level, 2), (room_access, {MC342, (room_access, MC325})} {MC320})} Daniel Servos & Sylvia L. Osborn HGABAC FPS’2014 9 / 31

Group Graph Min Group {} Undergrads Staff {(studet_level, 1), {(employe_level, 1), (room_access, {MC8, (room_access, MC10})} {MC355})} Faculty Gradstudents {(studet_level, 2), {(employe_level, 2), (room_access, {MC342, (room_access, MC325})} {MC320})} Effective: employe_level = {1, 2} room_access = {MC355, MC320} Daniel Servos & Sylvia L. Osborn HGABAC FPS’2014 9 / 31